Question

My company doesn’t want sensitive data to be stored as files unless they’re sanitized first. Anything in memory is fair game. So files downloaded from an FTP server must be sanitized in memory before storing it on disk.

I’m using Jsch as my SFTP library and wondered whether or not using InputStream objects actually implies storing a temp file somewhere on disk by the JRE?

Answer 1

Using InputStream does not imply a file on disk. That doesn’t mean Tomcat or some other intermediary doesn’t store it temporarily (or the operating system itself).

The InputStream could be backed by a AudioInputStream, ByteArrayInputStream, FileInputStream, FilterInputStream, InputStream, ObjectInputStream, PipedInputStream, SequenceInputStream, StringBufferInputStream, or any other kind of InputStream.